Thompson's RSA keynote.

I finally got around to watching John Thompson’s RSA keynote address this morning. I was hopeful that there would be something interesting here. There was. He was speaking on the topic of Information Centric Security. This is surprising to me. Partially because this is a concept that a lot of people in security have trouble getting their head around. So if the leaders in security still have trouble conceptually, mass acceptance is probably a long way off. Even more so, Information Centricity would require a metamorphic change to the products Symantec produces today. A decidedly non-perimeter, non-network, non-packet model that requires bi-directional establishment of trust does not fit with what they offer today. I am unaware of any company CEO that really follows through with changes that would adversely affect the usefulness of their core revenue generating products.  Still, his advocacy is encouraging.

There is a link for the presentation here if you did not see it during RSA.

The quote “The battleground for security no longer revolves around the infrastructure, it revolves around data” gives me a warm fuzzy feeling, being a non-network security guy.  Sure, a statement taken unto itself is rather generic. Just because you perceive a need to move away from a perimeter or network based model for security does not necessarily mean you endorse an information centric model.  But when put in context to the remainder of the presentation and the other quotes about the need for an information centric approach to security, digital rights management, security as a business enabler, white listing, linking security with data management, it appeared to me that he really ‘gets’ it. I am not trying to be condescending, rather my point is this does not appear to be marketing speak, but genuine understanding. Cool. I will be interested to see what the strategic product roadmap looks like to get there.

 

p.s. Does anyone know where the statistics came from about reaching the ‘inflection point’ that the lines of malicious code has grown equal to the lines of ‘legitimate’ code produced on a daily basis?